WordPress News
All-In-One Security (AIOS) 5.5.0 Released
What’s new in All-In-One Security (AIOS) 5.5.0
Released: 26/Oct/2026
Active installations: 1,000,000
Tested up to WordPress 7.1.3
Requires PHP 7.4
Changelog
- SECURITY: Prevented unauthorised clearing of login lockouts via an empty aiowps_auth_key parameter by requiring a valid nonce and unlock key. Thanks to Filip Kowalski for disclosing this defect.
- SECURITY: Do not allow WooCommerce to auto-login a user who has TFA active when they perform a password reset. i.e. On previous versions, if using WooCommerce’s “Lost password” facility, someone with access to the email account to which the password reset link was sent could login without providing a TFA code.
- SECURITY: On a site where users with lower privilege levels (e.g. subscriber) existed, a lower-privileged user could forge a request and thereby have his own TFA code accepted for someone else’s account. To complete login he would also need to know the password of the account he was logging into. Thanks to Karol Czubernat for the responsible disclosure, via WPScan.
- FEATURE: Added an Integration settings tab to connect a TeamUpdraft account, providing the authentication used by features that connect to the TeamUpdraft cloud.
- FEATURE: Added an optional redirect URL to the Rename Login Page feature, so non-logged-in visitors who try to access wp-admin can be sent to a chosen page instead of seeing a “you do not have permission” message.
- FEATURE: Added audit and debug logging to the firewall.
- FEATURE: Added a session mechanism to the firewall.
- FEATURE: Added a pagination dropdown to the audit logs table, allowing users to customize the number of logs displayed per page.
- FIX: Error log entry for Beginning attempt to port private key encryption over to openssl when unnecessary.
- FIX: Fixed warning “username” in notify_incorrect_tfa_code_attempts()
- FIX: If TFA is compulsory for user roles (Premium), it remains required even after downgrading to the free version.
- FIX: Resolve a PHP E_STRICT deprecation notice
Previous releases
5.4.10 — 16/Sep/2026
- SECURITY: Login lockout unlock requests allowed users to unlock another account’s lockout because they were validated based only on the IP address, without checking the user account. Thanks to Ananda Dhakal for disclosing this defect. (This would allow an attacker sharing the same IP address as a user with an active lockout to clear that user’s lockout.)
5.4.9 — 5/Jun/2026
- TWEAK: Added a filter that validates POST requests containing UDRPC messages
- TWEAK: Update the internal common libs package to latest version